Cybersecurity briefing, 2026-04-14

A critical vulnerability in Ninja Forms is being actively exploited right now, with thousands of attacks hitting WordPress sites in the last 24 hours alone.

• Malicious PDFs enable code execution across Windows and macOS
• Phishing marketplace takedown cuts supply but leaves stolen credentials active
• Mirax malware turns infected phones into anonymized fraud infrastructure
• Basic-Fit breach exposes 1 million members’ personal and bank data
• APT37 shifts to Facebook social engineering to deliver RokRAT malware
• Correlating signals exposes reachable Autonomous AI agent on Windows Server
• Adobe Reader zero-day uses stealthy fingerprinting before RCE
• JanelaRAT’s evolving multi-stage attacks sharpen focus on Latin American banks

Recent editions

• Monday, April 13, 2026: Phishing marketplace takedown cuts supply but leaves stolen credentials active · 16 stories
• Sunday, April 12, 2026: Signed CPUID installers delivered malware via DLL sideloading · 3 stories
• Saturday, April 11, 2026: Default password flaw enables immediate remote takeover of Juniper collectors · 9 stories
• Friday, April 10, 2026: Docker AuthZ bypass reopens host compromise risk · 8 stories
• Thursday, April 9, 2026: Immediate remote code execution risk in Ninja Forms File Uploads · 11 stories
• Wednesday, April 8, 2026: Attackers exploit both decade-old and new flaws in federal systems · 14 stories
• Tuesday, April 7, 2026: FortiClient EMS hotfixes leave uncertainty for 8.0 users · 13 stories